diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2020-03-20 16:23:34 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-08-19 08:16:05 +0200 |
| commit | 1a981f4d6c971b83a7eaf6da47c14398524c4e3b (patch) | |
| tree | b7b60bf4f814d5d8de76a292da580b12b522a2a9 | |
| parent | 167708cbebd3014de55234fa7f10b676c605186c (diff) | |
| download | linux-stable-1a981f4d6c971b83a7eaf6da47c14398524c4e3b.tar.gz linux-stable-1a981f4d6c971b83a7eaf6da47c14398524c4e3b.tar.bz2 linux-stable-1a981f4d6c971b83a7eaf6da47c14398524c4e3b.zip | |
drm/gem: Fix a leak in drm_gem_objects_lookup()
[ Upstream commit ec0bb482de0ad5e4aba2a4537ea53eaeb77d11a6 ]
If the "handles" allocation or the copy_from_user() fails then we leak
"objs". It's supposed to be freed in panfrost_job_cleanup().
Fixes: c117aa4d8701 ("drm: Add a drm_gem_objects_lookup helper")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Emil Velikov <emil.l.velikov@gmail.com>
Link: https://patchwork.freedesktop.org/patch/msgid/20200320132334.GC95012@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/gpu/drm/drm_gem.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c index 46ad14470d06..1fdc85a71cec 100644 --- a/drivers/gpu/drm/drm_gem.c +++ b/drivers/gpu/drm/drm_gem.c @@ -710,6 +710,8 @@ int drm_gem_objects_lookup(struct drm_file *filp, void __user *bo_handles, if (!objs) return -ENOMEM; + *objs_out = objs; + handles = kvmalloc_array(count, sizeof(u32), GFP_KERNEL); if (!handles) { ret = -ENOMEM; @@ -723,8 +725,6 @@ int drm_gem_objects_lookup(struct drm_file *filp, void __user *bo_handles, } ret = objects_lookup(filp, handles, count, objs); - *objs_out = objs; - out: kvfree(handles); return ret; |